Welcome to Home Linux Stuff: A comprehensive engineering journal and reference architecture for building resilient, hardened Linux infrastructure, declarative container services, and enterprise-grade homelabs.
Every guide in this knowledge base is designed for practical, modern operations: prioritizing immutable configurations, automated GitOps pipelines, zero-trust network ingress, client-side encrypted backups, and long-term maintainability without server sprawl or downtime.
The Production GitOps Workflow
Instead of manually editing configurations or running ad-hoc Docker commands across physical nodes, modern infrastructure treats Git as the single source of truth:
1. Declarative Repositories
Infrastructure is organized into dedicated repositories per environment. Pull requests enforce branch protection and automated linting scripts (docker compose config).
2. Webhook Orchestration
Merges trigger signed webhooks to Komodo Core. The orchestrator diffs the changed Compose files and coordinates zero-downtime rolling updates.
3. Node Periphery Agents
Target hosts run lightweight Komodo Periphery agents over secure internal websockets or WireGuard meshes, eliminating inbound SSH management ports entirely.
Master Runbook Index by Domain
1. GitOps & Declarative Infrastructure Automation
Version-controlled infrastructure-as-code, Komodo orchestration, native Docker secrets, and SSH multiplexing.
- Declarative Server Administration: Why We Avoid Web GUIs in Favor of GitOps, Tmux & Pure CLI
- Enterprise Secrets Management: Docker Native File Secrets and GitOps Security Hygiene
- Setting Up Git on Modern Linux (SSH Signing, Ed25519 & Best Practices)
- The Complete GitOps Deployment Lifecycle: Forgejo, Webhooks, Komodo & Docker Compose
2. Security & Edge Networking
Zero-Trust Cloudflare Tunnels, Tailscale mesh networking, Pocket-ID OIDC SSO, CrowdSec intrusion prevention, Caddy reverse proxies, and automated Let’s Encrypt DNS-01 certificates.
- Automated TLS Certificates: Let’s Encrypt Wildcards, ACME DNS-01 & Reverse Proxies
- Automating Edge Security: Cloudflare Origin Certificates & WAF Protections
- Deploying a Secure WireGuard & Tailscale Exit Node on a VPS for Private Mobile Egress
- Docker + UFW Firewall Security: Preventing Public Exposure & iptables Bypass
- Fleet-Wide Intrusion Prevention: Deploying CrowdSec with Docker, Caddy & Firewall Bouncers
- Hardening the Gateway: Firewalla Security Architecture, Custom DNS & Automated Post-Boot Scripts
- How to Lock Down and Harden a Fresh Linux VPS (Ubuntu / Debian)
- Lightweight Homelab Identity: Deploying Pocket-ID for OIDC Single Sign-On
- Modern Dynamic DNS: Cloudflare API Automation & Split-Horizon Resolution
- Modern Mesh VPN Architecture: Tailscale, Headscale, and WireGuard Site-to-Site Tunnels
- Modern Reverse Proxy Architecture: Caddy Server & Cloudflare Tunnels for Container Ingress
- Zero-Trust Edge Ingress: Deploying Cloudflare Tunnels (cloudflared) for Private Services
3. Storage & OpenZFS Architecture
Enterprise OpenZFS topologies, TrueNAS SCALE performance tuning, ARC cache sizing, dataset recordsize optimization, NVMe wear monitoring, and disk replacement.
- Enterprise Storage Architecture: TrueNAS SCALE, OpenZFS Topologies, ARC Caching & NVMe Tiering
- Managing and Pruning ZFS Snapshots with Native Properties and Sanoid
- Production Docker Engine Setup & daemon.json Hardening on a Linux VPS
4. Backups & Disaster Recovery
Client-side encrypted backups with Restic and Kopia to S3/B2, ZFS snapshot replication with Syncoid/Sanoid, and Proxmox PBS bare-metal recovery.
- Immutable Storage Backups: ZFS Replication, Air-Gapped Snapshots & Syncoid
- The 3-2-1 Backup Architecture: Automated Encrypted Restic Backups to B2 & S3 with Systemd Timers
5. Observability & System Health
Out-of-band Uptime Kuma monitoring with AutoKuma GitOps, Netdata telemetry, Vector structured JSON logging with Grafana Loki, and Network UPS Tools (NUT).
- Centralized Homelab Logging: Vector, Grafana Loki, and Structured JSON Telemetry
- Homelab Notification Pipelines: Multi-Channel Alerts with Webhooks & Ntfy
- Modern Homelab Observability: Netdata Telemetry & Uptime Kuma Health Checks
- Out-of-Band Infrastructure Monitoring: Deploying Uptime Kuma & AutoKuma on an External VPS
6. Self-Hosted Applications & Homelab Stacks
Immich photo management with ML, Paperless-ngx OCR digital archiving, Home Assistant, Frigate AI NVR, Jellyfin transcoding, Lyrion Music Server, and isolated torrent daemons.
- Homelab Status Dashboards: Modern Service Portals with Homepage and Dashy
- Modern Media Streaming: Jellyfin on Docker with Intel QuickSync & NVIDIA Hardware Transcoding
- Deploying Vaultwarden with Docker & Caddy: Hardened Self-Hosted Password Management
- Production Photo & Video Management: Deploying Immich with ML Acceleration on OpenZFS
- The Zero-Paper Household: Automated OCR, Tagging & Archiving with Paperless-ngx
7. Server Maintenance & Operations
Automated CVE security patching with unattended-upgrades and needrestart, S.M.A.R.T. predictive disk failure monitoring with smartd and Scrutiny, container auto-healing, and CLI productivity.
- Automated Security Patching & Maintenance Windows with unattended-upgrades and needrestart
- Predictive Drive Failure & S.M.A.R.T. Health Monitoring with smartd and Scrutiny
- Zero-Downtime Container Healthchecks, Auto-Healing & Safe Update Strategies
All runbooks are verified against modern Linux kernels (Debian 12 Bookworm, Ubuntu 24.04 LTS, TrueNAS SCALE Dragonfish/Electric Eel) with pure declarative workflows.